From: Paul Duncan <pabs@...>
Date: 2007-01-18T10:51:12+09:00
Subject: Re: RubyForge website

--qXCixuLMVvZDruUh
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Tom Copeland (tom@infoether.com) wrote:
> > A lot of projects in RubyForge have no website, other than=20
> > the "Hopefully coming soon..." message.  Might I suggest that=20
> > the site default to the RDoc of that gem (or gems)?
>=20
> Yup, or have that in one of the tabs for each project.
>=20
> > > Advantages:
> > * Every project has a site letting you know what it does=20
> > (sometimes there is next to no info on the project page).
> > * Encourages developers to keep the RDoc up to date
> > * The most common site that projects do have is simply their=20
> > RDoc.  So, we've removed one step for all of those projects.
> >=20
> > Disadvantages:
> > * Requires a little processing on the rubyforge server (to extract the
> > RDoc)
>=20
> Is there any security aspect to this - does running RDoc on a gem
> require installing it or executing any of the code in the gem?  I
> suppose it could be done on a different machine and uploaded to
> RubyForge, though...

Don't do this unless you either hard-code the RDoc template or limit it
to a pre-selected list.  Using the options specified in the Gem
specification allows Gem authors to run arbitrary Ruby code on the=20
RubyForge server.

I've written about this several times on the RubyGems mailing list in
the last week or so. For those of you not subscribed to the RubyGems
mailing list, you can find the relevant posts at the following URLs:

  http://rubyforge.org/pipermail/rubygems-developers/2007-January/002433.ht=
ml
  http://rubyforge.org/pipermail/rubygems-developers/2007-January/002454.ht=
ml
  http://rubyforge.org/pipermail/rubygems-developers/2007-January/002459.ht=
ml
  http://rubyforge.org/pipermail/rubygems-developers/2007-January/002466.ht=
ml
  http://rubyforge.org/pipermail/rubygems-developers/2007-January/002471.ht=
ml

Fair warning: Each post is longer and more detailed than the previous
one, so do yourself a favor and grab a soda or beer before diving in.

PS.  I have a mostly working patch for RubyGems that creates a protected
chroot() environment for generating documentation.  Since this seems to
be a topic of interest I'll get it clean enough to post for discussion.

> Yours,
>=20
> Tom

--=20
Paul Duncan <pabs@pablotron.org>        pabs in #ruby-lang (OPN IRC)
http://www.pablotron.org/               OpenPGP Key ID: 0x82C29562

--qXCixuLMVvZDruUh
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFFrtKKzdlT34LClWIRAtH5AKCWkLcGO8nL3556o3xzMH1uaDBcAwCdFVHM
7D2xIMVBSh7wTNF11IeG/iM=
=ArAg
-----END PGP SIGNATURE-----

--qXCixuLMVvZDruUh--